Demo Dev Post

Stories by Steve Vaughn on Medium

<h3>Un-permitted Parameters in Ruby on Rails — Why they don’t raise errors, and should they?</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*RZzgofBiE-2KkF121AdqNg.jpeg"><figcaption>Do not enter sign, credit: Unsplash</figcaption></figure>While working on my most recent project using a Ruby on Rails backend I noticed an intriguing default behavior when using mass assignment and strong parameters. If you need a refresher on strong parameters in RoR check out the documentation <a href="https://api.rubyonrails.org/classes/ActionController/StrongParameters.html">here</a>!
For this project I am just working on the backend, so I am using <a href="https://www.postman.com/">Postman</a> to check my routes and make sure everything works. This is where I noticed that any un-permitted parameters were being automatically filtered out, and an HTML status code of 2xx (“OK” or “Created” depending on the scenario) is returned. I wondered why there wouldn’t be a 4xx HTML code when trying to pass in a parameter that isn’t allowed, so I did some digging! Let’s start from the top and build out a part of this project.
<h4>Building a simple User model in Ruby on Rails</h4>
Let’s say we are building a User for our application. We start with using the built in rails generator to create everything we need; the model, the controller, the routes, and the schema for our database. rails g resource User username password_digest --no-test-framework.
<blockquote>*I like to add the--no-test-framework which removes the spec files for our user model, since for this project I am not going to be doing any TDD (Test Driven Development).</blockquote>
Now our user model is created and it has the parameters of username and password_digest.
<blockquote>We use password_digest when using the <a href="https://github.com/bcrypt-ruby/bcrypt-ruby">bcrypt</a> Ruby gem which safely encrypts our password. However, When creating a new user, we should still create it using {"password": "&lt;insert-password&gt;"} in the body of our JSON in Postman.</blockquote>
To make the :password and :username parameters permitted we add the user_params method into our UsersController as a private method. Make sure to pass those params into our create method. Our entire code should look something like this at this point:
<pre>class UsersController &lt; ApplicationController</pre>
<pre>def create user = User.create(user_params) render json: user, status: :created end</pre>
<pre>private</pre>
<pre>def user_params params.permit(:password, :username) end</pre>
<h4>Testing in Postman</h4>
Now, in Postman, let’s say I try to create a new user but pass in a parameter for email. The default behavior is to filter out the un-permitted parameter and keep the permitted params that we defined above. The result would be a new user that was created, with the HTTP code of 201 (created, as defined in the code above), and the email parameter was filtered out.
What if we wanted to see what the un-permitted parameter was during the development process of building our application? What if we are unknowingly passing in a bad param and want to debug our program before deployment.
Luckily, there is a way for us to raise an error built into rails!
<h3>How to Raise an Error for Un-permitted Parameters</h3>
Check out the documentation for rails/strong_parameters and specifically the handling of un-permitted keys <a href="https://github.com/rails/strong_parameters#handling-of-unpermitted-keys">here</a>. You will see that as long as you have rails version 4 or later, the ability to raise an error for un-permitted parameters is already there! The instructions are in the link, but there are some additional steps that I take to render the errors. Here is what I would do!
<ol>
<li>Go to config/environments/development.rb and add config.action_controller.action_on_unpermitted_parameters = :raise This will cause the ActionController::UnpermittedParameters error to pop up when you pass a parameter in that is not permitted in an update or create action as long as you have create! or update! with the ! at the end of it.</li>
<li>Then you can rescue that error using a rescue_from at the top of your desired controller file like so: rescue_from ActionController::UnpermittedParameters, with: :&lt;name-of-method&gt;</li>
<li>Be sure to add the method to your private methods! You can customize the error message. I chose to have it render the key:value pair of the un-permitted params like this: render json: { "Unpermitted Parameters": <a href="http://params.to/">params.to</a>_unsafe_h.except(:controller, :action, &lt;include-your-permitted-params-here!!&gt;)}, status: :unprocessable_entity</li>
<li>Using the .to_unsafe_h on params will turn all of the params into a standard Ruby hash. You can’t use .to_h on params unless they are all permitted, hence the reason .to_unsafe_h exists. Then I use .except to exclude the permitted params from being rendered in the error message, since we only want to display the params that caused the error!</li>
</ol>
Our final version of UsersController will look like this:
<pre>class UsersController &lt; ApplicationController wrap_parameters format: [] rescue_from ActionController::UnpermittedParameters, with: :render_unpermitted_params_response</pre>
<pre>def create user = User.create!(user_params) render json: user, status: :created end</pre>
<pre>def update user = User.find(params[:id]) user.update!(user_params) render json: user end</pre>
<pre>private </pre>
<pre>def user_params params.permit(:password, :username) end</pre>
<pre>def render_unpermitted_params_response render json: { "Unpermitted Parameters": params.to_unsafe_h.except(:controller, :action, :id, :username, :password).keys }, status: :unprocessable_entity end</pre>
Now when an un-permitted parameters is passed in, we get an error message that renders which key(s) are un-permitted along with a HTTP status code of 422. Great! It works! But…when it is needed to have this behavior?
<blockquote>We change the behavior for development, but NOT production. Why not both?</blockquote>
In production, it makes more sense to let any un-permitted parameters be filtered out as the default behavior. I only suggest adding this behavior in the development process to debug. Ideally, in a complete full-stack application you would create your front-end to control the forms and determine what information the client passes in while utilizing RoR validations to check their responses.
<blockquote>The client-side of an application shouldn’t be able to pass in un-permitted keys as long as you have built your front-end with that in mind!</blockquote>
Hopefully this gives you another tool for your debugging toolbox! Happy coding!
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=354a6c5ee759" width="1" height="1" alt=""><hr>
<a href="https://medium.com/codex/un-permitted-parameters-in-ruby-on-rails-why-they-dont-raise-errors-and-should-they-354a6c5ee759">Un-permitted Parameters in Ruby on Rails — Why they don’t raise errors, and should they?</a> was originally published in <a href="https://medium.com/codex">CodeX</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Un-permitted Parameters in Ruby on Rails — Why they don’t raise errors, and should they?

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*8-h056eTvukxDc11WledBA.jpeg"><figcaption>A metal structure of loops. Image credit: Unsplash</figcaption></figure>Today marks the 3rd week since I started my software engineering bootcamp. One of the first scenarios that I got hung up on was working with arrays and objects and feeling frustrated when trying to access information in those data structures.
Once I fully understood the distinction between what is iterable and what is enumerable I became more confident in working with complex data structures. I wanted to write this blog post to further solidify my understanding of this topic as well as hopefully help another software engineering student someday understand the difference.
<blockquote>To start, what is an official definition of these terms? Merriam-Webster gives these definitions:</blockquote>
<blockquote>
iterate: to say or do again or again and again enumerate: to ascertain the number of or to specify one after another</blockquote>
What I take from these definitions is that iteration isn’t as detailed or specific as enumeration. When we iterate, we are repeating something without concern of what that something really is. When we enumerate we look at each thing and gather information about it. Imagine a toy box full of dog toys. If we open the lid and try and count each toy without touching them, we are iterating. If we pull each toy out and count them we are enumerating. Enumerating also gives us a chance to look at each toy and determine what properties each toy has, such as does it have squeakers?
<figure><img alt="" src="https://cdn-images-1.medium.com/max/810/1*GAX72Ry7GXRZ-W5zvbvPdA.jpeg"><figcaption>My dog Olivia and all of her toys! #spoiled</figcaption></figure>What does this mean for JavaScript? We know that objects are a key:value pair of data and arrays are a collection of data. This data can be strings, numbers, booleans, and we can even have an array of objects! To relate back to our working definition of iterate vs. enumerate I think of Objects as being a more specific data structure than arrays. With an object we have a key:value pair (where we give the key a variable name) that we can reference. Whereas arrays are a more simple data structure that we access through their index.
<blockquote>Technically though…an array is actually an object where the key is the index and the value is what we see in the array. You’ll see this in action further down.</blockquote>
Let’s dig into some example using the JavaScript loops for…in and for…of. These loops allow us to either iterate or enumerate over a collection of data.
<blockquote>The for…in loop is used to enumerate. We can use this on objects and arrays.</blockquote>
<blockquote>The for…of loop is used to iterate. We can only use this on arrays.</blockquote>
Think of our toy box analogy. If I want to inspect each toy I need to go in the toy box. If I just want to see the toys, I open it and check the toys of the box.
We can’t iterate over an object because we need to take a closer look at the object to see its properties, and we can’t do that by just opening the toy box and glancing over the toys. Let’s dig into some real coding examples with JavaScript.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/441/1*J_-Fgrl_5T6EG4NNWGFn-Q.png"><figcaption>An array, and object, and an array of objects</figcaption></figure>Here we have an array with a collection of various data types (strings, a boolean, and a number), an object with some key:value pairs, and an array of objects. Let’s see what happens to each of these data structures with our different for loops!
<pre>for (const item of array) { console.log(item) } // LOGGED: ‘cat’ // LOGGED: ‘dog’ // LOGGED: 22 // LOGGED: true // LOGGED: ‘apples</pre>
<pre>for (const item in array) { console.log(item) } // LOGGED: 0 // LOGGED: 1 // LOGGED: 2 // LOGGED: 3 // LOGGED: 4</pre>
When we iterate over the array, we get the values of the array. When we enumerate over the array we get the index of each value. Let’s see what happens with our object!
<pre>for (const item of object) { console.log(item) } // LOGGED: TypeError: object is not iterable</pre>
<pre>for (const item in object) { console.log(item) } // LOGGED: number // LOGGED: name // LOGGED: age // LOGGED: isCool</pre>
When we iterate over the object we get an error that says “object isn’t iterable” which makes sense now! When we enumerate over the object we get the keys, but not the values. Interesting…so we looked at the item long enough to see what properties it has, but not well enough to determine the value of those properties. To use our toy box analogy, we saw that each toy has a squeaker, but not how many squeakers it has.
In order to do that, we use a special method called Object.values(), which will return an array of the values of whatever is passed inside the (). We can also use Object.keys() to get the keys, and Object.entries() to get both key and value.
<pre>Object.values(object) //=&gt; [1, ‘Steve’, 31, true]</pre>
<pre>Object.keys(object) //=&gt; [‘number’, ‘name’, ‘age’, ‘isCool’]</pre>
<pre>Object.entries(object) //=&gt; [ [‘number’, 1], [‘name’, ‘Steve], [‘age’, 31], [‘isCool’, true] ]</pre>
This allows us to take an object, and essentially turn it into an array so then we can iterate over it. It’s important to note that Object.entries() returns a nested array, with the key: value pair separated by commas, not a colon.
What about our arrayOfObjects? What happens when we use our for loops on that?
<pre>for (const item of arrayOfObjects) { console.log(item) } // LOGGED: { num: 1, name: ‘Steve’, age: 30, isCool: true } // LOGGED: { num: 2, name: ‘Jessica’, age: 28, isCool: true } // LOGGED: { num: 3, name: ‘Doyle’, age: ‘old’, isCool: true }</pre>
<pre>for (const item in arrayOfObjects) { console.log(item) } // LOGGED: 0 // LOGGED: 1 // LOGGED: 2</pre>
When we have an array where the value of each array is an object we actually use for…of to return each object. This makes sense when you break it down, but can be confusing when you look at it and ask yourself “how can I get those objects…I must need to enumerate” when you actually need to iterate since the objects are nested in an array. When we use for…in we just get the index of each item in the array.
Hopefully now you have a deeper understanding of how and when to use iteration and enumeration, which will result is less frustration when programming!
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=40a42dec576f" width="1" height="1" alt=""><hr>
<a href="https://medium.com/codex/learn-about-the-difference-between-iterate-and-enumerate-in-javascript-using-for-loops-40a42dec576f">Learn about the difference between iterate and enumerate in JavaScript using for loops.</a> was originally published in <a href="https://medium.com/codex">CodeX</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Learn about the difference between iterate and enumerate in JavaScript using for loops.

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*9T5qMOWVuRaqNW23U8HEPA.jpeg"></figure>My name is Steve Vaughn, and I am a professional musician that has decided to change careers into Software Engineering. My first blog post will outline why I made the decision and how I am going to make the change!
I love music. I love it so much that I made the decision in 7th grade that I wanted to be a professional musician. I was your typical band nerd all throughout high school — the chubby kid that took up an entire seat on the bus so I could take my baritone home every day — you can probably picture it! Fast forward to today, and 12-year-old Steve would be so excited that I am an Adjunct Professor of Euphonium at a large University, principal tubist with a regional orchestra, and playing in a championship-level British-style Brass Band.
So then, why the career change? Believe it or not, there’s not that much demand for professional tuba and euphonium players (shocking, I know). The path to success for classical musicians is often one of 2 roads (or both); a tenure-track position teaching in academia or playing with a full-time orchestra or military band. Since COVID, tenure track positions are few and far between, and the pay is often embarrassingly low for a job requiring a doctorate. I was offered a lecturer position that was advertised as doctorate required in 2019 for a whopping $42K/year. Military bands offer great benefits, pay, and depending on the position, don’t require you to ever shoot a gun. However, these auditions are fiercely competitive and I can count on one hand the number of openings in the past 5 years.
<blockquote>I received some of advice from a friend who made a career change out of classical music. He said, “I care more about living somewhere that I like more than I care about playing the tuba somewhere I don’t want to be”</blockquote>
The low supply of these jobs means that you often have to be willing to move anywhere at anytime when you are offered a position. When I turned down that 42K/year job in a HCOL area I decided that I like living where I am, and the connections I’ve made in this area. I turned down that job and took a high school teaching position that made decent money, but I didn’t enjoy the stress of classroom teaching.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/774/1*Yr99yJKUGRwxE_3-CJTcdA.jpeg"><figcaption>Can I discard classroom management and SLO’s?</figcaption></figure>What are the things that I do enjoy about music? I reflected on this question and realized that the musical things in my life that bring me joy all happen outside of a normal M-F, 9–5 work day. The late night/weekend gigs and teaching a few private lessons at the university are all things I can still do while in a different career.
I started seriously looking into what other things I might be interested in, and software engineering was first to mind. It runs in my family too! My mom worked for IBM and I grew up around computers. I remember using Netscape on our IBM ThinkPad laptop and playing DOOM on it when my mom wasn’t working.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/320/1*r8p-gfWOhv88k_2m8bMWHw.jpeg"><figcaption>Doom95 on an IBM ThinkPad</figcaption></figure>My next step was to figure out how to learn the skills needed to actually get a job in this field. I saw a post on Facebook from a fellow musician who had just graduated from the Flatiron School in their Software Engineering program. We talked a bit and after hearing what the courses were like and doing some courses on freeCodeCamp I decided this is the field I want to move in to!
This blog is long enough already, so I will end it here saying that I am enrolled in the Flatiron School Immersive Software Engineering Course starting on June 7th. I am so excited to explore this new (but familiar) career and see what it has in store for me!
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=9d2eb54a92a0" width="1" height="1" alt="">

Medium Blogs